CVE-2026-84201: appium-mcp-server Path Traversal Vulnerability

CVE-2026-84201 Overview

CVE-2026-84201 is a path traversal vulnerability [CWE-22] in appium-mcp-server through version 0.1.61. The server exposes write_file and write_files_batch tools that do not validate or normalize file paths before writing. Attackers can supply absolute paths or relative paths containing parent directory segments to write files outside the intended PROJECT_ROOT directory. Successful exploitation lets an attacker overwrite arbitrary files with the server user's privileges, including shell profiles such as .bashrc and configuration files under the home directory.

Critical Impact
Arbitrary file write outside PROJECT_ROOT allows overwriting shell profiles and user configuration files, which can lead to code execution in the server user's context.

Affected Products

appium-mcp-server npm package through version 0.1.61
Model Context Protocol (MCP) integrations that expose the write_file tool
Model Context Protocol (MCP) integrations that expose the write_files_batch tool

Discovery Timeline

2026-09-01 - CVE-2026-84201 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84201

Vulnerability Analysis

The appium-mcp-server package implements MCP tools that accept file paths from a caller and write content to disk. The write_file and write_files_batch tools take a caller-supplied path parameter and pass it to file write operations without canonicalizing the path or confirming that the resolved location remains inside the configured PROJECT_ROOT. Because the MCP server acts on behalf of an AI client, a malicious or manipulated prompt can direct the server to target sensitive files outside the project directory. The vulnerability requires local access and user interaction with the MCP client, which is reflected in the CVSS 4.0 vector components AV:L and UI:P.

Root Cause

The root cause is missing input validation on the file path argument. Neither write_file nor write_files_batch in the affected release performs path normalization, resolves symbolic links, or verifies that the final absolute path is a descendant of PROJECT_ROOT. Absolute paths such as /home/user/.bashrc and traversal sequences such as ../../etc/config bypass the intended sandbox because no allow-list check is applied before the write.

Attack Vector

An attacker who can influence the arguments passed to the MCP server, for example through a crafted document, repository, or prompt processed by the connected AI client, invokes write_file or write_files_batch with a target path outside PROJECT_ROOT. The server writes attacker-controlled content to the target location with the privileges of the account running the MCP server. Overwriting shell startup files such as .bashrc, .zshrc, or .profile yields code execution the next time an interactive shell is started by that user. See the VulnCheck Appium MCP Server Advisory and the GitHub Write Files Batch Script for the vulnerable implementation.

Detection Methods for CVE-2026-84201

Indicators of Compromise

Unexpected modifications to shell startup files including .bashrc, .zshrc, .profile, and .bash_profile under the account running appium-mcp-server.
New or modified files under the user home directory, ~/.ssh/, or ~/.config/ that correlate with appium-mcp-server process activity.
File write operations by the MCP server process targeting paths outside the configured PROJECT_ROOT.

Detection Strategies

Monitor process telemetry for appium-mcp-server child or write operations whose target path does not resolve under PROJECT_ROOT.
Alert on MCP tool invocations of write_file or write_files_batch where the path argument contains .. segments or begins with /.
Baseline file integrity for shell profiles and SSH configuration files on hosts running MCP servers and alert on drift.

Monitoring Recommendations

Enable audit logging on the MCP server host for file writes to $HOME, /etc, and ~/.ssh/authorized_keys.
Centralize MCP tool invocation logs and inspect arguments for path traversal patterns before writes are executed.
Correlate MCP server file writes with subsequent shell session starts to identify profile-poisoning follow-on activity.

How to Mitigate CVE-2026-84201

Immediate Actions Required

Inventory all systems running appium-mcp-server and identify versions at or below 0.1.61 via the npm Package for Appium MCP Server.
Restrict who can send tool calls to the MCP server and disable write_file and write_files_batch where they are not required.
Run the MCP server under a dedicated low-privilege account with no write access outside the intended project directory.
Audit shell profiles and SSH configuration files on affected hosts for unauthorized changes.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. The advisory covers appium-mcp-server through 0.1.61. Track the VulnCheck Appium MCP Server Advisory and the upstream repository for a patched release, and upgrade once a version above 0.1.61 that validates paths is available.

Workarounds

Wrap or fork the server to canonicalize each path with an equivalent of os.path.realpath and reject any path whose resolved location is not a descendant of PROJECT_ROOT.
Run the MCP server inside a container or chroot with a read-only filesystem outside the project directory to contain arbitrary writes.
Apply mandatory access controls, such as AppArmor or SELinux profiles, that deny the server user write access to $HOME and system configuration paths.

bash

# Configuration example: run appium-mcp-server as an isolated user with a scoped project directory
sudo useradd -r -m -d /srv/appium-mcp mcpuser
sudo -u mcpuser mkdir -p /srv/appium-mcp/project
export PROJECT_ROOT=/srv/appium-mcp/project
sudo -u mcpuser env PROJECT_ROOT="$PROJECT_ROOT" \
    npx appium-mcp-server